3 Recommendations to Minimize Liability in Outsourced Data Security. Hello Vendors.

  • “include specific data security procedure obligations in contracts with vendors

  • verify a vendor’s capacity to adhere to the prescribed data security procedures

  • look at data security practices from an expert’s perspective to determine whether such practices are reasonable”

National Law Review | Piercing Outsourcing Veil: FTC Says Data Security Obligations Remain 

U.S. Chamber on Data Security. 3 Points.

  • A patchwork of state laws is hard on business
  • Requires a single regulatory agency
    • Currently the FTC, FCC & state agency wrangle over regulatory authority
  • Clear legal standards on what constitute harm from a data breach

U.S. Chamber Institute for Legal Reform | A Perilous Patchwork: Data Privacy and Civil Liability in the Era of the Data Breach

Lege Trend: Data Security Bill Passes over Tech Objections. 3 Pros. 3 Opposition Points.

The U.S. Senate passed Cybersecurity Information Sharing Act on a vote of 74-21 this week.

Tech Companies continue their opposition. The main bones of contention:

  • Mechanism for sharing of cyber-threat information does not sufficiently protect users’ privacy ”  (Computer & Communications Industry Assoc.)
  • “[ Does not ] appropriately limit the permissible uses of information shared within the government” (Computer & Communications Industry Assoc.)
  • “Privacy-shredding” bill “in cybersecurity clothing” (ACLU)

Supporters of CISA, Cybersecurity Information Sharing Act say:

  • Voluntary information-sharing provisions are key to defeating cyberattacks (Senator McConnell)
  • Protects civil liberties and individual privacy  (Senator McConnell)
  • Allows companies to share information in an effort to protect their systems from potentially damaging cyberattacks (Senator Feinstein)

Courthouse News Service | Cybersecurity Bill Sails Through Senate Despite Privacy Concerns

SC Magazine |CISA Watch: Bill passes Senate with 74-21 vote

Washington Post | Senate passes cybersecurity information sharing bill despite privacy fears

Federal Cyber Security Bill. 3 Points to Know Now. Which Businesses are on which side?

  • The Cybersecurity Information Sharing Act passed the U.S. Senate on Thursday, October 22nd.
  • Major Tech companies (Apple, DropBox) are opposed
  • National Retail Federation support amendment to CISA that offer liability protection for business that share threat data with the FBI and Secret Service, and not just the Department of Homeland Security.

Washington Post | Cybersecurity bill advances in Senate, but hurdles remain

National Retail Federation | Borad based Coalition Supports Cotton Amendment

Regulatory Trend: Cybersecurity & Connected Cars. (Wifi Cars, not Trains)

What agency is talking cybersecurity & cars? The FTC

What committee heard from the FTC? Subcommittee on Commerce, Manufacturing and Trade of the House Energy and Commerce Committee

What did the FTC testify to?

  • FTC is the “the nation’s lead privacy and data security enforcement agency”
  • Proposed legislation is weaker than the FTC rulemaking on “connected cars”
  • Proposed safe harbor for auto manufacturers that submit privacy policies to the Department of Transportation was too broad
  • The propsed legislation significantly limit consumer protections
  • “Prevent the FTC from taking action related to privacy issues beyond a manufacturer’s cars, including its use of consumer data collected from its websites”
  • Proposed legislation permits retoractive cahnges to privacy policies by manufacturers
  • The proposal included a creation of a council to develop cybersecurity best practices for the industry with too many industry representatives

Imperial Valley News | FTC Testifies on Proposed Legislation Addressing Privacy and Security in Connected Automobiles

5 Ways Federal CyberSecurity Bill will Impact Health Care

  • It will “create a framework that would allow different healthcare entities to exchange information regarding cybersecurity”
  • Allow for the exchange of  various potential threats
  • Allow health care entities to share best practice security measures
  • Cybersecurity bill would make the health care cybersecurity netowrk available to both private and federal healthcare entities
  • Healthcare Information and Management Systems Society supports the bill

Health IT Security | Senate Pursues Legislation for More Health IT Cybersecurity

East Coast State Has Potential Medicaid Data Breach

What happened and where? North Carolina Health Department announced a possible Medicaid data breach.

What personal data was included? confidential health information of 1,615 Medicaid patients. Only 2 Social Security Numbers were included, as most patients used Medicaid ID numbers. No birth dates were included.
 

How did it occur? a state employee sent unencrypted data to a local health agency

 

 

WRAL | DHHS reveals potential Medicaid data breach

A State Auditor Looks into 5 School District Student Data Collection

The Missouri State Auditor is looking into data security, data breach, data retention policies in 5 school districts.

The review also included reviewing the state education agency data policies. The state agency will soon adopt policies related to data breaches.

MissouriNet | Missouri education department to change student data collection after audit

Student Data Security Regulatory Trend from State of Huckleberry Finn. 4 Things the Agency Will Do Differently.

Which state is getting on the student data security bandwagon? Missouri

What prompted regulatory action by the Missouri Department of Education? An Audit that found the department of education “unnecessarily collected and kept personal information from students”

What chages will occur at this education agency? 

  • Missouri will no longer colelct and store student social security numbers when they don’t need social security numbers
  • Missouri will destroy unneeded sensitive data from its systems
  • Missouri will maintain the information it does need safely and securely
  • Missouri will create policies for dealing with data breaches & update its policy for recovering from a data breach

MissouriNet | Missouri education department to change student data collection after audit

 

Millions of Funding for Data Security for Electric Generation, Electric Grids & Oil & Gas.

  • Cyber Resilient Energy Delivery Consortium heads the $28.1 effort
  • Consists of 11 national laboratories and universities and is led by the University of Illinois
  • Dartmouth received a $925,000 grant to “improve the protection of the electric grid and oil and natural gas infrastructure from cyber threats”

Concord Monitor | AP | Dartmouth College gets $925K cybersecurity grant